Problem z zamulającym komputerem

Dla specjalistów Bezpieczeństwo
#1

Witam szanowne grono forumowiczów jestem tu nowy więc jeśli napisałem temat w złym dziale proszę o przeniesienie

#2

Pobierz Farbar Recovery Scan Tool http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ zgodny z wersją systemu 32-bit lub 64-bit.

Uruchom FRST i kliknij Scan. Pokaż raport FRST i Addition.

Raporty umieść na http://wklej.org/ i podaj link.

#3

FRST

 

 

Addition

http://wklej.org/id/1487976/

#4

Otwórz Notatnik i wklej:

Task: {0E6E56A7-6C8C-4540-940D-46877DE06E78} - System32\Tasks\95e33380 = C:\Users\marek\AppData\Local\Temp\\setup2573349632.exe ==== ATTENTION
Task: {117F8323-222A-4137-9376-780BB09D8D68} - \f5487370 No Task File ==== ATTENTION
Task: {16C92CCB-5C34-4591-8402-1E40DCC0D697} - System32\Tasks\27be90c0 = C:\Users\marek\AppData\Local\Temp\\setup2481894912.exe ==== ATTENTION
Task: {20184849-8429-4629-823E-3DBBA98D5781} - \9f6c4670 No Task File ==== ATTENTION
Task: {29A96C4E-32B3-438A-8A05-5CF026710A58} - System32\Tasks\8235edc0 = C:\Users\marek\AppData\Local\Temp\\setup1248252352.exe ==== ATTENTION
Task: {2B0FFD6E-43BA-400C-A6AF-43AA8FD20845} - System32\Tasks\a56d25c0 = C:\Users\marek\AppData\Local\Temp\\setup98913728.exe ==== ATTENTION
Task: {2C1B51B5-B0A0-40F8-AC7C-7EED3E19B8D8} - System32\Tasks\37627f80 = C:\Users\marek\AppData\Local\Temp\\setup569656640.exe ==== ATTENTION
Task: {311FF43B-F088-48EF-B259-FCCB5A4E5FC6} - System32\Tasks\d7d5f540 = C:\Users\marek\AppData\Local\Temp\\setup693723392.exe ==== ATTENTION
Task: {423ACF74-4425-4C35-B9BC-D1C7EBB496FC} - System32\Tasks\f79d5600 = C:\Users\marek\AppData\Local\Temp\\setup3686123520.exe ==== ATTENTION
Task: {45FC262B-F666-43E3-AC8B-5CAC82D69BD6} - \c23c1bf0 No Task File ==== ATTENTION
Task: {4787E870-3611-4E2E-970E-2AE5C2A6B202} - System32\Tasks\21fa57c0 = C:\Users\marek\AppData\Local\Temp\\setup160414592.exe ==== ATTENTION
Task: {4AEF9A21-4CA8-4A60-966F-C7E1C1A45089} - System32\Tasks\a7dde6c0 = C:\Users\marek\AppData\Local\Temp\\setup2348177600.exe ==== ATTENTION
Task: {4F905248-7A8A-40E9-9530-DD0E73D270A2} - System32\Tasks\48e1cb80 = C:\Users\marek\AppData\Local\Temp\\setup696077248.exe ==== ATTENTION
Task: {50ACF6DB-754C-4C7F-B592-E70AD55FFFC8} - \57fa90b0 No Task File ==== ATTENTION
Task: {6117C929-61F0-46BF-ABA0-D33E120E9F77} - System32\Tasks\83ac2c80 = C:\Users\marek\AppData\Local\Temp\\setup1740938880.exe ==== ATTENTION
Task: {615BE683-7998-4E5A-BD93-6594E71CCF1E} - System32\Tasks\7f334500 = C:\Users\marek\AppData\Local\Temp\\setup1490346432.exe ==== ATTENTION
Task: {687D4558-4F03-4DED-82CF-DA18F2C5576B} - System32\Tasks\2bfef840 = C:\Users\marek\AppData\Local\Temp\\setup516537280.exe ==== ATTENTION
Task: {7316614E-D531-4850-9904-5CCBF4966692} - System32\Tasks\327f0140 = C:\Users\marek\AppData\Local\Temp\\setup94424192.exe ==== ATTENTION
Task: {7A562C0B-EDFD-426E-ABBC-1E00C3192696} - System32\Tasks\83aeb740 = C:\Users\marek\AppData\Local\Temp\\setup1372865472.exe ==== ATTENTION
Task: {7CE35A0B-6A85-4F24-87F4-6FCACEDCB237} - System32\Tasks\7cf66800 = C:\Users\marek\AppData\Local\Temp\\setup4050690560.exe ==== ATTENTION
Task: {7CF771F1-FC5D-498F-AC98-243B2C37964F} - \ccdf0d30 No Task File ==== ATTENTION
Task: {895ACF0A-3929-4628-96B8-5511CC0F890D} - System32\Tasks\77b7b4c0 = C:\Users\marek\AppData\Local\Temp\\setup1540368064.exe ==== ATTENTION
Task: {949C0B80-95C1-4AC5-8452-B5DB3D0E8A28} - \b08cd930 No Task File ==== ATTENTION
Task: {99BDE053-F005-41E4-AF09-8301FEC5A9A5} - \4de8afb0 No Task File ==== ATTENTION
Task: {9C499283-0D0B-428C-BC66-6C804F5042BC} - \13e3a130 No Task File ==== ATTENTION
Task: {A1143994-0324-4F67-B536-DE18957D179D} - System32\Tasks\6e79f9c0 = C:\Users\marek\AppData\Local\Temp\\setup1385327552.exe ==== ATTENTION
Task: {A76D6F59-0DCB-485A-8BD1-95E02607394F} - \3e3af9b0 No Task File ==== ATTENTION
Task: {A7FAE821-9113-4C07-A576-691376B134F5} - System32\Tasks\474596c0 = C:\Users\marek\AppData\Local\Temp\\setup727582912.exe ==== ATTENTION
Task: {B0C7A800-7491-4EE9-9B9C-D26F2219B980} - System32\Tasks\31eada80 = C:\Users\marek\AppData\Local\Temp\\setup2288682240.exe ==== ATTENTION
Task: {B1DD77F9-F3F5-436C-822B-6C63784A0A6C} - \c0f90730 No Task File ==== ATTENTION
Task: {BA962061-0191-403E-935E-32F352C8EE78} - System32\Tasks\9af4dd00 = C:\Users\marek\AppData\Local\Temp\\setup2190098624.exe ==== ATTENTION
Task: {C0F896FF-9624-499A-A1B8-6DF2A85EC052} - \465d3e30 No Task File ==== ATTENTION
Task: {C28B7E16-7C22-4F50-B34D-17147EDDCDE8} - System32\Tasks\399d87c0 = C:\Users\marek\AppData\Local\Temp\\setup1497792512.exe ==== ATTENTION
Task: {C31024DA-CA5F-4F0E-B492-13CBED341599} - \b628a030 No Task File ==== ATTENTION
Task: {C6472300-FCF5-4542-A566-087B5F147F4C} - \2b485c30 No Task File ==== ATTENTION
Task: {CE04E8C5-FDA1-440F-B659-92F1A6032869} - System32\Tasks\186fad80 = C:\Users\marek\AppData\Local\Temp\\setup4119739392.exe ==== ATTENTION
Task: {CF175179-5F0D-4E52-A215-5308557E3239} - System32\Tasks\5984eb80 = C:\Users\marek\AppData\Local\Temp\\setup1033723264.exe ==== ATTENTION
Task: {D1CB841F-9396-4A3A-87B1-DF9A3241BA84} - System32\Tasks\6ad04840 = C:\Users\marek\AppData\Local\Temp\\setup701642944.exe ==== ATTENTION
Task: {D4687E47-2A7E-43A4-BA31-63A19B40F3FB} - \86e21670 No Task File ==== ATTENTION
Task: {D665AC3A-AFF1-412C-85CF-77E31F94966F} - \612a7b30 No Task File ==== ATTENTION
Task: {D9AAC584-0F82-4292-A9E8-089B4554C6AD} - System32\Tasks\f1f2b800 = C:\Users\marek\AppData\Local\Temp\\setup3591055872.exe ==== ATTENTION
Task: {DB848D3A-DA22-45D1-99A8-39CD36690E97} - System32\Tasks\dcd65c00 = C:\Users\marek\AppData\Local\Temp\\setup2897963072.exe ==== ATTENTION
Task: {DD3C8C74-A76B-4D58-AE4A-E9644E8DB02B} - System32\Tasks\1add0a00 = C:\Users\marek\AppData\Local\Temp\\setup3658340928.exe ==== ATTENTION
Task: {DD7167A0-BA3D-410A-915A-63B9DA553D08} - System32\Tasks\e2354080 = C:\Users\marek\AppData\Local\Temp\\setup1035020736.exe ==== ATTENTION
Task: {E42FAAC8-C90E-4A96-A58A-F0FFDA3AB5B2} - System32\Tasks\1b152b00 = C:\Users\marek\AppData\Local\Temp\\setup3001583168.exe ==== ATTENTION
Task: {E979319C-49E4-4B5A-A15D-5049D1C2FF71} - System32\Tasks\92af4040 = C:\Users\marek\AppData\Local\Temp\\setup805526336.exe ==== ATTENTION
Task: {F04AA49D-D17F-429E-BAFA-778CB45AC301} - System32\Tasks\b09b6ac0 = C:\Users\marek\AppData\Local\Temp\\setup35575424.exe ==== ATTENTION
Task: {F949F36A-F943-4111-944A-D8110122EB3F} - \d91821b0 No Task File ==== ATTENTION
GroupPolicyUsers\S-1-5-21-1652410064-855316490-4250319663-1000\User: Group Policy restriction detected ======= ATTENTION
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL =
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\mystartsearch.xml
CHR HomePage: Default - hxxp://www.mystartsearch.com/?type=hpts=1413213938from=mp3uid=WDCXWD2500BEVS-22UST0_WD-WXE10803642336423
CHR StartupUrls: Default - "hxxp://www.mystartsearch.com/?type=hpts=1413213938from=mp3uid=WDCXWD2500BEVS-22UST0_WD-WXE10803642336423"
CHR DefaultSearchKeyword: Default - mystartsearch
CHR Extension: (Broowse2usavE) - C:\Users\marek\AppData\Local\Google\Chrome\User Data\Default\Extensions\jecokjoimlikiaogfkmbikhacblbddkg [2013-03-14]
S3 catchme; \\C:\Users\marek\AppData\Local\Temp\catchme.sys [X]
U2 CscService; No ImagePath
S3 esgiguard; \\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S3 massfilter_hs; system32\drivers\massfilter_hs.sys [X]
S3 swmsflt; \SystemRoot\System32\drivers\swmsflt.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]
2014-10-13 18:07 - 2014-10-13 18:07 - 00000000 ____ D () C:\Program Files\Enigma Software Group
2014-10-13 18:06 - 2014-10-13 23:20 - 00000000 ____ D () C:\Windows\455F074C814E4520B69B5584BD90400C.TMP
2014-10-13 18:06 - 2014-10-13 18:06 - 00000000 ____ D () C:\Program Files\Common Files\Wise Installation Wizard
2014-10-13 17:32 - 2014-10-13 17:41 - 00000000 ____ D () C:\Users\marek\AppData\Local\16691
2014-10-13 23:31 - 2013-11-10 15:34 - 00000000 ____ D () C:\AdwCleaner
C:\Users\marek\MediaInfo.dll
EmptyTemp:

Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.

#5

Zrobione

Fixlog

http://wklej.org/id/1488123/

#6

Skasuj folder C:\FRST

#7

Gotowe jeszcze raz dzięki :slight_smile: